On 08/23/2011 09:26 AM, Rich Megginson wrote:
Can you provide the exact aci you used below?
>
> dc=messinet,dc=com (anonymous perms removed, all other defaults intact)
> |
> +-ou=People (allowed
dns=localhost,messinet.com,*.messinet.com)
> |
> +-ou=Groups (allowed
dns=localhost,messinet.com,*.messinet.com)
> |
> +-ou=Special Users (allowed
dns=localhost,messinet.com,*.messinet.com)
> |
> +-ou=Computers (allowed
dns=localhost,messinet.com,*.messinet.com)
> |
> +-ou=eGW (allowed
dns=localhost,messinet.com,*.messinet.com)
>
> -A
Attached, find the original ACIs I used prior to
389-ds-base-1.2.9.6-1.fc15.i686
Since the upgrade, I have needed to leave the following default in place:
aci: (targetattr != "userPKCS12 || userPassword")(version 3.0;acl
"Enable anon
ymous access"; allow (read,compare,search)(userdn = "ldap:///anyone");)
But as you can see, the makes it incredibly difficult to restrict acces
based on tree structure as everyone already has read access. -A
--
Anthony -
http://messinet.com -
http://messinet.com/~amessina/gallery
8F89 5E72 8DF0 BCF0 10BE 9967 92DC 35DC B001 4A4E